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IN THE CLAIMS 



Please add claims 30 and 31. 



1 . (Original) A method for recording network usage, the method comprising the steps 




/ defining a network data collector including an encapsulajor, an aggregator, and a data 

storage system; / 
receiving a set of network accounting data via the ©ncapsulator; 
converting the network accounting data set to a j^andard data format; 
processing the network accounting data set v^ the aggregator, including the steps of 

defining a rule chain and applying^e rule chain to the network accounting 

data set to construct an aggregajron tree including creating an aggregated 

network accounting data set; mvd 
storing the aggregated network acg?ounting data set in the data storage system, 

2. (Original) The method of claim 1, wherein the step of applying the rule chain to the 
network accounting data set to coi^truct the aggregation tree includes the step of applying a 
rule from the rule chain to the network accounting data set to define a group node. 

3. (Original) The metnod of claim 2, wherein the rule is a match rule. 

4. (Original) The method of claim 1, wherein the step of applying the rule chain to the 
network accounting^ data set to construct the aggregation tree includes the step of applying a 
set of match rule/ to the network accounting data set to define a hierarchy of group nodes 
within the aggregation tree. 

5. (Original) The method of claim 4, wherein the step of applying the rule chain to the 
network Recounting data set to construct the aggregation tree includes the step of applying an 



2 



Amendment and Response 

Applicant: Alexander C. Ranous et al. 
Serial No.: 09/560,032 
Filed: April 27, 2000 
Docket No.: 10002142-1 

Title: INTERNET USAGE DATA RECORDING SYSTEM AND METHOD EMPLOYING A 

CONFIGURABLE RULE ENGINE FOR THE PROCESSING AND CORRELATION OF NETWORK 
DATA 

aggregation rule to the match group node to create the aggregated network accounting data 
set. 



6. (Original) The method of claim 1 , wherein the step of applying tWrule chain to the 
network accounting data set to construct the aggregation tree includes^e step of applying a 
data manipulation rule to the network accounting data set. 

7. (Original) The method of claim 6, further comprising/fiie step of defining the data 
manipulation rule to be an adornment rule. 

8. (Original) The method of claim 6, further cy6iprising the step of defining the data 
manipulation rule to be a filtering rule. 

9. (Original) The method of claim l,y^herein the network accounting data set is a set of 
session data. 

10. (Original) The method of^aim 1, wherein the network accounting data set is a set of 
usage data. 

11. (Original) The mecliod of claim 1, further comprising the step of defining a data flush 
interval; and wherein the step of storing the aggregated network accounting data set includes 
the step of transferring the aggregated network accounting data to the data storage system 
after a period of time associated with the data flush interval. 

12. (Original) The method of claim 1, further comprising the step of defining a rule 
within the rme chain by a Java object class, and allowing additional rule types to be added to 
the rule chain corresponding to the Java object class. 

13. / (Original) A method for recording network usage including correlating of network 
usage information and network session information, the method comprising the steps of: 
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defining a network data correlator collector including an encapsulatory^ aggregator, 
and a data storage system; 

receiving a set of network session data via the encapsulator; / 

processing the network session data set via the aggregator/including the steps of 
defining a first rule chain and applying the first rule chain to tHe network session data to 
construct an aggregation tree; / 

receiving a set of network usage data via the ejacapsulator; 

processing the network usage data set via tjafe aggregator, including the steps of 
defining a second rule chain and applying the s^ond rule chain to the network usage data and 
the aggregation tree to construct a correlateja aggregation tree; 

determining a correlated data set/from the correlated aggregation tree; and 

storing the correlated data set/m the data storage system. 

14. (Original) The method/of claim 13, wherein the network session data set is in a 
standard data format receiv^ from a session data collector having an encapsulator, an 
aggregator and a data storage system. 

15. (Original) yThe method of claim 14, wherein the network usage data set is in the 
standard data fomiat received from a usage data collector having an encapsulator, an 
aggregator aira a data storage system 

16. ^Original) The method of claim 13, further comprising the step of defining the first 
mle set to be different than the second rule set. 

V7. (Original) A method for recording network usage comprising the steps of: 

defining a first network data collector including a first encapsulator, a first aggregator, 

and a first data storage system; 

receiving a first set of network data via the first encapsulator; 

processing the first network data set via the first aggregator, including the steps of 
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defining an aggregation rule chain and determining a first set of aggregated data by applying 
the aggregation rule chain to the first set of network data; and / 

storing the first aggregated network data set in the first data storage system. 

18. (Original) The method of claim of claim 17, wherein the step of applying the 
aggregation rule chain to the first set of network data furthepxomprises the steps of: 

constructing an aggregation tree; and / 

determining the first aggregated network data set from the aggregation tree. 

19. (Original) The method of claim 18, whecein the step of constructing an aggregation 
tree further includes the steps of: / 

defining the first network data set tc/includes a first network data event and a second 
network data event; / 

applying the aggregation rulcydiain to the first network data event to construct a 
hierarchy of group nodes within the aggregation tree; and 

applying the aggregatioji rule chain to the second network data event to locate similar 
group nodes according to a predefined set of match rules, if no matching group nodes exist, 
extending the hierarchy or group nodes within the aggregation tree by creating additional 
group nodes. / 

20. (Original/ The method of claim 19, wherein the step of applying the aggregation rule 
chain to the fipt network data event further includes the steps of: 

defitnng the aggregation rule chain to include a first match rule for matching source 
IP addres*^ 

/defining the first network data event to include a first source IP address; 
/ applying the first match rule to the first network data event, including determining 
/ whether the aggregation tree includes a first group node matching the first source IP 
/ address; and 

if a matching first group node does not exist, creating the first group node for the first 
source IP address. 
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2 1 . (Original) The method of claim 20, wherein the step of applying aggregation rule 
chain to the first network data event further includes the steps of: / 

defining the aggregation rule chain to include a second match rule^or matching 
destination IP address; / 

defining the first network data event to include a first desthmtion BP address; 

applying the second match rule to the first network data/event, including determining 
whether the aggregation tree includes a second group node notching the first destination IP 
address; and / 

if a matching second group node does not exisT; creating the second group node for 
the first destination IP address. / 

22. (Original) The method of claim 21, wnerein the step of applying the aggregation rule 
chain to the first network data event furth^ includes the steps of: 

defining the aggregation rule sej4o include an aggregation rule; 

defining the first network data event to include a port number and volume of 
information; / 

applying the aggregation rule to the first network data event, including copying the 
port number, source IP address, destination IP address and volume information to the second 
group node. / 

23. (Original) Tl^ method of claim 17, further comprising the steps of: 

defining a/econd network data collector including a second encapsulator, a second 
aggregator, and/a second data storage system; 

receiving a second set of network data via the second network encapsulator; 

processing the second network data set via the second aggregator, including the steps 
of defining a second rule chain and applying the second rule chain to the second set of 
netwcfrk data to define a second set of aggregated network data; and 

/ storing the second aggregated network data set in the second data storage system. 
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24. (Original) A network usage recording system having a network data collector, the 
network data collector comprising: / 

an encapsulator for receiving a set of network accounting data and converting the 
network accounting data set to a standard data format; / 

an aggregator for processing the network accounting data set, the aggc^ator including 
a defined rule chain, wherein the aggregator applies the rule chain to the rework accounting 
data set to construct an aggregation tree, and determines a set of aggregated network 
accounting data from the aggregation tree; and / 

a data storage system for storing the aggregated network^ccounting data. 

25. (Original) The system of claim 24, wherein the process of applying the rule chain to 
the network accounting data performs data reduction jem the network data. 

26. (Original) A network usage recording system having a network data correlator 
collector, the network data correlator collector comprising: 

an encapsulator which receives a set of network session data; 

an aggregator for processing the network session data set, the aggregator including a 
defined first rule chain, wherein the/aggregator applies the first rule chain to the network 
session data set to construct an aggregation tree; 

wherein the encapsulate?^ receives a set of network usage data, and the aggregator 
processes the network usagoxiata set, the aggregator including a defined second rule chain, 
wherein the aggregator applies the second rule chain to the network usage data set and the 
aggregation tree to cormruct a correlated aggregation tree, and determines a correlated data 
set from the correlated aggregation tree; and 

a data storage system for storing the correlated data set. 

27. (Origmal) The system of claim 26, wherein the network session data set is in a 
standard data format received from a session data collector having an encapsulator, an 
aggregate and a data storage system. 
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28. (Original) The system of claim 27, whereinjiae-iletwork usage data set is in the 
standard data format received from a usagg^ddla collector having an encapsulator, an 
aggregator and a data storage systei 

29. (Original) Th^/^stem of claim 26, further wherein the first rule set is different than 
the second rule se 



JO. (New) A method for recording network usage comprising: 
\^ J defining a first network data collector including a first encapsulator, a first aggregator, 
/and a first data storage system; 

receiving a first set of network data via the first encapsulator; 
processing the first network data set via the first aggregator, including the steps of 
defining an aggregation rule chain and determining a first set of aggregated data by applying 
the aggregation rule chain to the first set of network data; and 

storing the first aggregated network data set in the first data storage system; 
wherein applying the aggregation rule chain to the first set of network data 
further comprises: 

constructing an aggregation tree; and 

determining the first aggregated network data set from the aggregation tree; 
wherein constructing an aggregation tree further includes defining the first network 
data set to includes a first network data event and a second network data event; 

applying the aggregation rule chain to the first network data event to construct 
a hierarchy of group nodes within the aggregation tree; and 

applying the aggregation rule chain to the second network data event to locate 
similar group nodes according to a predefined set of match rules, if no matching group nodes 
exist, extending the hierarchy of group nodes within the aggregation tree by creating 
additional group nodes; 

wherein applying the aggregation rule chain to the first network data event further 
includes: 



8 



Amendment and Response 
Applicant: Alexander C. Ranous et al. 
Serial No.: 09/560,032 
Filed: April 27, 2000 
Docket No.: 10002142-1 

Title: INTERNET USAGE DATA RECORDING SYSTEM AND METHOD EMPLOYING A 

CONHGURABLE RULE ENGINE FOR THE PROCESSING AND CORRELATION OF NETWORK 
DATA 

defining the aggregation rule chain to include a first match rule for matchi; 
source IP address; 

defining the first network data event to include a first source IP q^tlress; 
applying the first match rule to the first network data event, 
includingdetermining whether the aggregation tree includes a first groun/node matching the 
first source IP address; and if a matching first group node does not e^^t, creating the first 
group node for the first source IP address; 

wherein applying aggregation rule chain to the first network data event further 
includes: 

defining the aggregation rule chain to ^lude a second match rule for 
matching destination IP address; 

defining the first network data e/ent to include a first destination IP address; 

applying the second match n«e to the first network data event, including 
determining whether the aggregation tre^includes a second group node matching the first 
destination IP address; and if a matching second group node does not exist, creating the 
second group node for the first desunation IP address; 

wherein applying the a^regation rule chain to the first network data event further 
includes: 

defining thi^ aggregation rule set to include an aggregation rule; 
definin§/ihe first network data event to include a port number and volume of 

information; 

applying the aggregation rule to the first network data event, including 
copying the porr number, source IP address, destination IP address and volume information to 
the second group node. 




31. G^ew) The method of claim 30, further comprising: 

defining a second network data collector including a second encapsulator, a second 
ag^egator, and a second data storage system; 

receiving a second set of network data via the second network encapsulator; 
processing the second network data set via the second aggregator, including: 
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defining a second rule chain^ntTapplying the second rule chain to the second 
set of network data to define a second^^ of aggregated network data; and 

storing the secojKfaggregated network data set in the second data storage 

system. 
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